A practical, field-tested operational security checklist for journalists, NGO workers, lawyers, military families, and anyone operating in environments where digital privacy is not optional.
Maintained by Predaxia - privacy for people who have something to lose.
- Journalists working with confidential sources or in hostile environments
- NGO workers operating in countries with active surveillance
- Lawyers handling sensitive client data across jurisdictions
- Military families managing OPSEC while a member is deployed
- Travelers crossing borders with sensitive devices or data
- Anyone in a divorce or legal dispute where device access is contested
- Prepare a clean travel device (not a factory reset), a properly prepared device
- Enable full-disk encryption (FileVault on Mac, BitLocker on Windows, LUKS on Linux)
- Set a strong alphanumeric password (12+ characters) — not biometric only
- Back up your primary device to encrypted storage, then leave it at home
- Remove sensitive apps (Signal history, password managers with source data)
- Review what a border agent can actually extract from a seized device
- If using 1Password: enable Travel Mode to hide sensitive vaults
- Default messaging: Signal with disappearing messages enabled
- Never contact sources from a work device, work email, or work network
- Understand that email metadata exposes more than content
- Strip EXIF data from all photos before sending a single photo got a source arrested
- Use a VPN you trust, we recommend Mullvad or Proton VPN
- Check for signs of monitoring if in a domestic dispute
- Understand that Pegasus requires no user interaction
- Separate identities: work device, personal device, operational device — never mix them
- Know what you are protecting, from whom build your threat model
- Do not consent to a search unless legally required know the law
- Know what they extract in 6 hours with forensic tools
- If in an NGO context, follow field seizure protocol
Not all VPNs are equal. Most free VPNs sell your data. A VPN won't save you if your device is already compromised.
We tested and recommend:
- Mullvad — review — no email, no name, cash payment
- Proton VPN — review — audited, Secure Core routing
- Comparison: Proton vs Mullvad
We refuse to recommend NordVPN, Surfshark, or ExpressVPN.
59 OPSEC and privacy terms explained for civilians: predaxia.com/glossary
- The FBI recovered deleted Signal messages from a seized iPhone (April 2026)
- The FBI seized a Washington Post reporter's phone with 1,200 Signal sources (April 2026)
- Hong Kong made it a crime to refuse device unlock at the border (April 2026)
Predaxia is an independent publication covering operational security for civilians. We test tools under real conditions, document field failures, and write for people whose privacy is not theoretical.
There is no perfect setup. Anyone selling you perfect is selling fear. The goal is simple: make yourself a harder target than the person next to you.
© 2026 Predaxia — predaxia.com